From 466f1c075edd5359b0d7bbc4b6a9f1dcc8305ea0 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Wed, 1 Sep 2021 16:04:31 +0200 Subject: [PATCH] Bug 28935: No filtering on patron's data on member entry pages Content-Type: text/plain; charset=utf-8 Security patch. Follow-up for 28929. Backported minimalistically. Including correction for gonenoaddress and two others. --- members/memberentry.pl | 4 ++-- opac/opac-memberentry.pl | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/members/memberentry.pl b/members/memberentry.pl index c9460583af..6bd6161e5c 100755 --- a/members/memberentry.pl +++ b/members/memberentry.pl @@ -215,7 +215,7 @@ if ( $op eq 'insert' || $op eq 'modify' || $op eq 'save' || $op eq 'duplicate' ) # remove keys from %newdata that is not part of patron's attributes { my @keys_to_delete = ( - qr/^flags$/, + qr/^(borrowernumber|date_renewed|debarred|debarredcomment|flags|privacy|privacy_guarantor_fines|privacy_guarantor_checkouts|checkprevcheckout|updated_on|lastseen|lang|login_attempts|overdrive_auth_token|anonymized)$/, # Bug 28935 qr/^BorrowerMandatoryField$/, qr/^category_type$/, qr/^check_member$/, @@ -323,7 +323,7 @@ if ($op eq 'save' || $op eq 'insert'){ # If the cardnumber is blank, treat it as null. $newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/; - if (my $error_code = checkcardnumber($newdata{cardnumber},$newdata{borrowernumber})){ + if (my $error_code = checkcardnumber( $newdata{cardnumber}, $borrowernumber )){ push @errors, $error_code == 1 ? 'ERROR_cardnumber_already_exists' : $error_code == 2 diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl index c940a6e1af..34f13a3e27 100755 --- a/opac/opac-memberentry.pl +++ b/opac/opac-memberentry.pl @@ -522,7 +522,9 @@ sub ParseCgiForBorrower { # Replace checkbox 'agreed' by datetime in gdpr_proc_consent $borrower{gdpr_proc_consent} = dt_from_string if $borrower{gdpr_proc_consent} && $borrower{gdpr_proc_consent} eq 'agreed'; - delete $borrower{flags}; + delete $borrower{$_} for qw/borrowernumber date_renewed debarred debarredcomment flags privacy privacy_guarantor_fines privacy_guarantor_checkouts checkprevcheckout updated_on lastseen lang login_attempts overdrive_auth_token anonymized/; # See also members/memberentry.pl + delete $borrower{$_} for qw/dateenrolled dateexpiry borrowernotes opacnote sort1 sort2 sms_provider_id autorenew_checkouts gonenoaddress lost relationship/; # On OPAC only + return %borrower; } -- 2.20.1